Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
0060599005-A05-049-4.pdf

Overview

General Information

Sample name:0060599005-A05-049-4.pdf
Analysis ID:1431068
MD5:398a2ac72d023fee742020f4c5bd9afc
SHA1:65e4dfd26cc6bd07967558ee01691661faaad4c3
SHA256:e73b7f86bf046705c827bfb3e87f7787245aa04a365d08c51a2f8ae185918068
Infos:

Detection

Score:1
Range:0 - 100
Whitelisted:false
Confidence:80%

Signatures

Potential document exploit detected (performs HTTP gets)
Potential document exploit detected (unknown TCP traffic)
Uses a known web browser user agent for HTTP communication

Classification

Process Tree

  • System is w10x64
  • Acrobat.exe (PID: 2164 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\0060599005-A05-049-4.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)
    • AcroCEF.exe (PID: 6968 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
      • AcroCEF.exe (PID: 7360 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1648,i,11272463363651122756,7076105234141228624,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 23.61.208.184:443 -> 192.168.2.5:49737
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 23.61.208.184:443 -> 192.168.2.5:49737
Source: global trafficTCP traffic: 23.61.208.184:443 -> 192.168.2.5:49737
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 23.61.208.184:443 -> 192.168.2.5:49737
Source: global trafficTCP traffic: 23.61.208.184:443 -> 192.168.2.5:49737
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 23.61.208.184:443 -> 192.168.2.5:49737
Source: global trafficTCP traffic: 23.61.208.184:443 -> 192.168.2.5:49737
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 23.61.208.184:443 -> 192.168.2.5:49737
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 23.61.208.184:443 -> 192.168.2.5:49737
Source: global trafficTCP traffic: 23.61.208.184:443 -> 192.168.2.5:49737
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 192.168.2.5:49737 -> 23.61.208.184:443
Source: global trafficTCP traffic: 23.61.208.184:443 -> 192.168.2.5:49737
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownTCP traffic detected without corresponding DNS query: 23.61.208.184
Source: unknownTCP traffic detected without corresponding DNS query: 23.61.208.184
Source: unknownTCP traffic detected without corresponding DNS query: 23.61.208.184
Source: unknownTCP traffic detected without corresponding DNS query: 23.61.208.184
Source: unknownTCP traffic detected without corresponding DNS query: 23.61.208.184
Source: unknownTCP traffic detected without corresponding DNS query: 23.61.208.184
Source: unknownTCP traffic detected without corresponding DNS query: 23.61.208.184
Source: unknownTCP traffic detected without corresponding DNS query: 23.61.208.184
Source: unknownTCP traffic detected without corresponding DNS query: 23.61.208.184
Source: unknownTCP traffic detected without corresponding DNS query: 23.61.208.184
Source: unknownTCP traffic detected without corresponding DNS query: 23.61.208.184
Source: global trafficHTTP traffic detected: GET /onboarding/smskillreader.txt HTTP/1.1Host: armmf.adobe.comConnection: keep-aliveAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brIf-None-Match: "78-5faa31cce96da"If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
Source: classification engineClassification label: clean1.winPDF@14/41@0/1
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journalJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-24 14-35-40-395.logJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
Source: unknownProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\0060599005-A05-049-4.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1648,i,11272463363651122756,7076105234141228624,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1648,i,11272463363651122756,7076105234141228624,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess created: unknown unknownJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: 0060599005-A05-049-4.pdfInitial sample: PDF keyword /JS count = 0
Source: 0060599005-A05-049-4.pdfInitial sample: PDF keyword /JavaScript count = 0
Source: 0060599005-A05-049-4.pdfInitial sample: PDF keyword stream count = 53
Source: 0060599005-A05-049-4.pdfInitial sample: PDF keyword /EmbeddedFile count = 0
Source: 0060599005-A05-049-4.pdfInitial sample: PDF keyword obj count = 54
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Exploitation for Client Execution		Path Interception1
Process Injection		1
Masquerading		OS Credential Dumping1
System Information Discovery		Remote ServicesData from Local System1
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
Process Injection		LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable Media1
Non-Application Layer Protocol		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive12
Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin HookBinary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture1
Ingress Tool Transfer		Traffic DuplicationData Destruction

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1431068 Sample: 0060599005-A05-049-4.pdf Startdate: 24/04/2024 Architecture: WINDOWS Score: 1 6 Acrobat.exe 17 62 2->6         started        process3 8 AcroCEF.exe 103 6->8         started        process4 10 AcroCEF.exe 2 8->10         started        dnsIp5 13 23.61.208.184, 443, 49737 AKAMAI-ASUS United States 10->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
0060599005-A05-049-4.pdf0%ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
fp2e7a.wpc.phicdn.net
192.229.211.108
truefalse
    		unknown

    World Map of Contacted IPs

    • No. of IPs < 25%
    • 25% < No. of IPs < 50%
    • 50% < No. of IPs < 75%
    • 75% < No. of IPs

    Public IPs

    IPDomainCountryFlagASNASN NameMalicious
    23.61.208.184
    		unknownUnited States
    		16625AKAMAI-ASUSfalse

    General Information

    Joe Sandbox version:40.0.0 Tourmaline
    Analysis ID:1431068
    Start date and time:2024-04-24 14:34:28 +02:00
    Joe Sandbox product:CloudBasic
    Overall analysis duration:0h 4m 31s
    Hypervisor based Inspection enabled:false
    Report type:full
    Cookbook file name:defaultwindowspdfcookbook.jbs
    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
    Number of analysed new started processes analysed:9
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Sample name:0060599005-A05-049-4.pdf
    Detection:CLEAN
    Classification:clean1.winPDF@14/41@0/1
    EGA Information:Failed
    HCA Information:
    • Successful, ratio: 100%
    • Number of executed functions: 0
    • Number of non-executed functions: 0
    Cookbook Comments:
    • Found application associated with file extension: .pdf
    • Found PDF document
    • Close Viewer

    Warnings

    • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
    • Excluded IPs from analysis (whitelisted): 20.190.190.195, 20.190.190.193, 20.190.190.130, 20.190.190.129, 40.126.62.130, 20.190.190.194, 20.190.190.196, 20.190.190.131, 104.85.240.187, 107.22.247.231, 34.193.227.236, 18.207.85.246, 54.144.73.197, 172.64.41.3, 162.159.61.3, 184.28.81.158, 184.28.81.142
    • Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, client.wns.windows.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, slscr.update.microsoft.com, acroipm2.adobe.com.edgesuite.net, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, p13n.adobe.io, acroipm2.adobe.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, ocsp.edge.digicert.com, geo2.adobe.com, www.tm.lg.prod.aadmsa.trafficmanager.net
    • VT rate limit hit for: 0060599005-A05-049-4.pdf

    Simulations

    Behavior and APIs

    ⊘No simulations

    Joe Sandbox View / Context

    IPs

    ⊘No context

    Domains

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    fp2e7a.wpc.phicdn.nethttps://2h.ae/HWtBGet hashmaliciousUnknownBrowse
    • 192.229.211.108
    https://www.clinical-partners.co.ukGet hashmaliciousUnknownBrowse
    • 192.229.211.108
    http://www.clinical-partners.co.ukGet hashmaliciousUnknownBrowse
    • 192.229.211.108
    https://bafybeialjrwo2ct3n2glolpm3zfawtv73xej3opbbgjsfewkonoew4x5xe.ipfs.cf-ipfs.com/?sourceId=ukcompanyformations@vistra.comGet hashmaliciousUnknownBrowse
    • 192.229.211.108
    http://stake.libertariancounterpoint.comGet hashmaliciousUnknownBrowse
    • 192.229.211.108
    https://www.nirsoft.net/utils/pinginfoview.zipGet hashmaliciousUnknownBrowse
    • 192.229.211.108
    https://nitftts.com/Get hashmaliciousHtmlDropper, HTMLPhisherBrowse
    • 192.229.211.108
    https://postnoord.dk.yiff.fi/sunia/u/r/Get hashmaliciousUnknownBrowse
    • 192.229.211.108
    https://pwrdevelopment.top/Get hashmaliciousHtmlDropper, HTMLPhisherBrowse
    • 192.229.211.108
    http://www.clinical-partners.co.ukGet hashmaliciousUnknownBrowse
    • 192.229.211.108

    ASNs

    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
    AKAMAI-ASUShttps://i.imgur.com/EoTj4iI.pngGet hashmaliciousUnknownBrowse
    • 184.28.252.71
    https://i.imgur.com/VlAllek.pngGet hashmaliciousUnknownBrowse
    • 184.28.252.71
    Z4CYGTBlj7.exeGet hashmaliciousBabuk, Clipboard Hijacker, Djvu, VidarBrowse
    • 184.85.65.125
    SUwX12D2S6.exeGet hashmaliciousBabuk, Clipboard Hijacker, Djvu, VidarBrowse
    • 23.66.133.162
    file.exeGet hashmaliciousPureLog Stealer, VidarBrowse
    • 23.66.133.162
    rq0mVjR9ar.exeGet hashmaliciousBabuk, Clipboard Hijacker, Djvu, VidarBrowse
    • 96.17.209.196
    8jvTeVxooN.exeGet hashmaliciousBabuk, Djvu, VidarBrowse
    • 184.30.90.143
    https://tibusiness.cl/css/causarol.rarGet hashmaliciousUnknownBrowse
    • 23.217.9.75
    http://damarltda.cl/certificado.phpGet hashmaliciousUnknownBrowse
    • 23.200.60.110
    Payment MT103.xlsGet hashmaliciousUnknownBrowse
    • 23.200.60.110

    JA3 Fingerprints

    ⊘No context

    Dropped Files

    ⊘No context

    Created / dropped Files

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):294
    Entropy (8bit):5.200990920340979
    Encrypted:false
    SSDEEP:6:vEFJX4q2P92nKuAl9OmbnIFUt8YP3JZmw+YP3DkwO92nKuAl9OmbjLJ:k54v4HAahFUt8UJ/+UD5LHAaSJ
    MD5:AA3EA330FC5AF8C7D0F364728BEE5168
    SHA1:7D0D57ACF3FDE3A7E1DF8BBA095957038814BE64
    SHA-256:14A3EBE4AA110C506F8C9ECA7A9CAA8F2C75F5BAD6D44F9DEB83DE60FF2EE7CA
    SHA-512:1BBAF2711DEF939633229E58ECEDF3FFA0CA419F99DD251083D560A914E03FFCEF070FE26F55E08A6B4F802F329666C25A2ECB1E2FC0D2D877119314D649A3F5
    Malicious:false
    Reputation:low
    Preview:2024/04/24-14:35:38.431 1564 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/24-14:35:38.432 1564 Recovering log #3.2024/04/24-14:35:38.432 1564 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):294
    Entropy (8bit):5.200990920340979
    Encrypted:false
    SSDEEP:6:vEFJX4q2P92nKuAl9OmbnIFUt8YP3JZmw+YP3DkwO92nKuAl9OmbjLJ:k54v4HAahFUt8UJ/+UD5LHAaSJ
    MD5:AA3EA330FC5AF8C7D0F364728BEE5168
    SHA1:7D0D57ACF3FDE3A7E1DF8BBA095957038814BE64
    SHA-256:14A3EBE4AA110C506F8C9ECA7A9CAA8F2C75F5BAD6D44F9DEB83DE60FF2EE7CA
    SHA-512:1BBAF2711DEF939633229E58ECEDF3FFA0CA419F99DD251083D560A914E03FFCEF070FE26F55E08A6B4F802F329666C25A2ECB1E2FC0D2D877119314D649A3F5
    Malicious:false
    Reputation:low
    Preview:2024/04/24-14:35:38.431 1564 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2024/04/24-14:35:38.432 1564 Recovering log #3.2024/04/24-14:35:38.432 1564 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):338
    Entropy (8bit):5.174639927719111
    Encrypted:false
    SSDEEP:6:vVQL+q2P92nKuAl9Ombzo2jMGIFUt8YWFfApGKWZmw+YOQLVkwO92nKuAl9Ombzz:m+v4HAa8uFUt8DFfAoKW/+4V5LHAa8RJ
    MD5:082F50A56DBA3DE2CB8391E77E05A323
    SHA1:7D41FE5421068B5C0E110AFD74A815DCD994B6CD
    SHA-256:9B658E4D5E19FDE052C6CB4A401C35266EBB03E76BF61CBD295756A6AB15F25B
    SHA-512:A0840E1B511C2851387E919CE807155214DFD278AB77E028A042F44CAFC7AE7F1B5E65643B34746ADFB218AEFD3F80C0DC769CEC3939999B1333C48ED7C5642A
    Malicious:false
    Reputation:low
    Preview:2024/04/24-14:35:38.486 1cec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/24-14:35:38.491 1cec Recovering log #3.2024/04/24-14:35:38.492 1cec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):338
    Entropy (8bit):5.174639927719111
    Encrypted:false
    SSDEEP:6:vVQL+q2P92nKuAl9Ombzo2jMGIFUt8YWFfApGKWZmw+YOQLVkwO92nKuAl9Ombzz:m+v4HAa8uFUt8DFfAoKW/+4V5LHAa8RJ
    MD5:082F50A56DBA3DE2CB8391E77E05A323
    SHA1:7D41FE5421068B5C0E110AFD74A815DCD994B6CD
    SHA-256:9B658E4D5E19FDE052C6CB4A401C35266EBB03E76BF61CBD295756A6AB15F25B
    SHA-512:A0840E1B511C2851387E919CE807155214DFD278AB77E028A042F44CAFC7AE7F1B5E65643B34746ADFB218AEFD3F80C0DC769CEC3939999B1333C48ED7C5642A
    Malicious:false
    Reputation:low
    Preview:2024/04/24-14:35:38.486 1cec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2024/04/24-14:35:38.491 1cec Recovering log #3.2024/04/24-14:35:38.492 1cec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1edb9bfe-1e18-4d1e-9803-456aa919981d.tmp

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:JSON data
    Category:modified
    Size (bytes):508
    Entropy (8bit):5.056897427179479
    Encrypted:false
    SSDEEP:12:YH/um3RA8sqZfyhsBdOg2HZcaq3QYiubxnP7E4T3OF+:Y2sRdsayydMHg3QYhbxP7nbI+
    MD5:E16374CE3014B1B735853E043E1DDB79
    SHA1:5CB57D7D539D911142E7D30BB88BEBBF0E27A2AD
    SHA-256:DF85C6ECDC1C07F822C163662A12C03CB92D82B8642916ABE10D1D318B9B60F0
    SHA-512:26D8CBC5BDDDF5A0114CB74146AA5F5B004BAE9D3C9694B142ADF02465AB8FAE7DF1AFE9310F658D5D01152B3CDB1BF8709E6D32152CBD270B33CF9C6B3AB5B8
    Malicious:false
    Reputation:low
    Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358522150114476","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":154779},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):508
    Entropy (8bit):5.056897427179479
    Encrypted:false
    SSDEEP:12:YH/um3RA8sqZfyhsBdOg2HZcaq3QYiubxnP7E4T3OF+:Y2sRdsayydMHg3QYhbxP7nbI+
    MD5:E16374CE3014B1B735853E043E1DDB79
    SHA1:5CB57D7D539D911142E7D30BB88BEBBF0E27A2AD
    SHA-256:DF85C6ECDC1C07F822C163662A12C03CB92D82B8642916ABE10D1D318B9B60F0
    SHA-512:26D8CBC5BDDDF5A0114CB74146AA5F5B004BAE9D3C9694B142ADF02465AB8FAE7DF1AFE9310F658D5D01152B3CDB1BF8709E6D32152CBD270B33CF9C6B3AB5B8
    Malicious:false
    Reputation:low
    Preview:{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13358522150114476","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":154779},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:data
    Category:dropped
    Size (bytes):4509
    Entropy (8bit):5.2312357876470985
    Encrypted:false
    SSDEEP:96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUKP6Lk6SPFmoZ:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLB
    MD5:AACF7813C8888E6A3988BDA58B3965DC
    SHA1:EB974D6F702DE58C12DC84251A8FECFC750C1246
    SHA-256:69C848927058B643DEB1F471CA5D9D923FEE53CC32B92940EC43C79F86E0A9B9
    SHA-512:381751A5F353311D409D87258969AAB6B97AED1B06A90B59A01113B0FE68B2D94A5C3434BCE6313A328C6A62EAE13E01DCA0A1F28678D3E1D76E890FCB279C07
    Malicious:false
    Reputation:low
    Preview:*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):326
    Entropy (8bit):5.175885701727754
    Encrypted:false
    SSDEEP:6:vRpQL+q2P92nKuAl9OmbzNMxIFUt8Y2jSGKWZmw+YMQLVkwO92nKuAl9OmbzNMFd:U+v4HAa8jFUt8zKW/+2V5LHAa84J
    MD5:A72B99532793264FD9DBB8C404F7BB9C
    SHA1:AD123C922D100164550CFC78D3F2BB6240A8B77F
    SHA-256:4495C04FE8548BB710FB8E1B59303E9CF759CC8F46C070D3E33042C790B62071
    SHA-512:DC5084BA28BB47A07FCBAF6170D7A02F7C04107703A420FD4627ED3D26C30D623BB0C79D09054C496BB7350BC0F8BF48E648768A2858CAB6E4320BDD1303A256
    Malicious:false
    Reputation:low
    Preview:2024/04/24-14:35:38.710 1cec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/24-14:35:38.712 1cec Recovering log #3.2024/04/24-14:35:38.713 1cec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

    C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:ASCII text
    Category:dropped
    Size (bytes):326
    Entropy (8bit):5.175885701727754
    Encrypted:false
    SSDEEP:6:vRpQL+q2P92nKuAl9OmbzNMxIFUt8Y2jSGKWZmw+YMQLVkwO92nKuAl9OmbzNMFd:U+v4HAa8jFUt8zKW/+2V5LHAa84J
    MD5:A72B99532793264FD9DBB8C404F7BB9C
    SHA1:AD123C922D100164550CFC78D3F2BB6240A8B77F
    SHA-256:4495C04FE8548BB710FB8E1B59303E9CF759CC8F46C070D3E33042C790B62071
    SHA-512:DC5084BA28BB47A07FCBAF6170D7A02F7C04107703A420FD4627ED3D26C30D623BB0C79D09054C496BB7350BC0F8BF48E648768A2858CAB6E4320BDD1303A256
    Malicious:false
    Reputation:low
    Preview:2024/04/24-14:35:38.710 1cec Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2024/04/24-14:35:38.712 1cec Recovering log #3.2024/04/24-14:35:38.713 1cec Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

    C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240424123542Z-168.bmp

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54
    Category:dropped
    Size (bytes):71190
    Entropy (8bit):1.9891367147772758
    Encrypted:false
    SSDEEP:192:sT366tGcq+6ZCplhre7t7men01NqzsZDNeFCnfbLoRwB90EBrnZMu2BmNMJPPn:g66AbCpnKt7mWcqRFCnPdihPn
    MD5:6CBCFABEBB3428B286C59178A1D4D1A7
    SHA1:5245E5471AE0704DD34D0162692581B2BB2A325E
    SHA-256:81352850A2A0F2905BCAE1610EBFC55F45436E1BAC47E9BA07B8B945EF6599F0
    SHA-512:5948782345C05DE609EB18989ADF6A3410C7F8FAD5938A62E3BE359EDA74A74BBAF6EAA6285E3874AE22896E10F462652C3904BC1EAA6E25088E2D9522025531
    Malicious:false
    Reputation:low
    Preview:BM........6...(...u...h..... ..............................................................................}......{...{.................................................................................................}..|..z..y..x..w..v..w..u..u..s..r..p..n..m..l..l..h..k..n..r..x.................t..l..l..k..i..g..e..c..b..a...`..._...^...\...Z...X...W...W...U...S...Q...O...M...I...H...I...H..~G...C..}C..|B..|@..z>..z:..z:..y8..w6..w2.....................................................................................w...u....................................................................................~..}..|..z..y..w..w..w..w..u..u..r..q..o..n..q..t..w..}..............}..v..u..s..p..n..n..m..k..i..h..f..e..c..b..b..`...^...]...Z...Y...X...W...T...S...R...Q...P...P...R...Q...P...K...G..~D..~B..}A..|<..|;..z:..z:..x7...........

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3500

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:PostScript document text
    Category:dropped
    Size (bytes):185099
    Entropy (8bit):5.182478651346149
    Encrypted:false
    SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
    MD5:94185C5850C26B3C6FC24ABC385CDA58
    SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
    SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
    SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
    Malicious:false
    Reputation:moderate, very likely benign file
    Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:PostScript document text
    Category:dropped
    Size (bytes):185099
    Entropy (8bit):5.182478651346149
    Encrypted:false
    SSDEEP:1536:JsVoWFMWQNk1KUQII5J5lZRT95tFiQibVJDS+Stu/3IVQBrp3Mv9df0CXLhNHqTM:bViyFXE07ZmandGCyN2mM7IgOP0gC
    MD5:94185C5850C26B3C6FC24ABC385CDA58
    SHA1:42F042285037B0C35BC4226D387F88C770AB5CAA
    SHA-256:1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
    SHA-512:652657C00DD6AED1A132E1DFD0B97B8DF233CDC257DA8F75AC9F2428F2F7715186EA8B3B24F8350D409CC3D49AFDD36E904B077E28B4AD3E4D08B4DBD5714344
    Malicious:false
    Preview:%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Reg.FamilyName:Agency FB.StyleName:Regular.MenuName:Agency FB.StyleBits:0.WeightClass:400.WidthClass:3.AngleClass:0.FullName:Agency FB.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB.FileLength:58920.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:AgencyFB-Bold.FamilyName:Agency FB.StyleName:Bold.MenuName:Agency FB.StyleBits:2.WeightClass:700.WidthClass:3.AngleClass:0.FullName:Agency FB Bold.WritingScript:Roman.hasSVG:no.hasCOLR:no.VariableFontType:NonVariableFont.WinName:Agency FB Bold.FileLength:60656.NameArray:0,Win,1,Agency FB.NameArray:0,Mac,4,Agency FB Bold.NameArray:0,Win,1,Agency FB.%EndFont..%BeginFont.Handler:WinTTHandler.FontType:TrueType.FontName:Algerian.FamilyName:Algerian.StyleName:Regular.MenuName:Algerian.StyleBits:0.We

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:data
    Category:dropped
    Size (bytes):227002
    Entropy (8bit):3.392780893644728
    Encrypted:false
    SSDEEP:1536:WKPC4iyzDtrh1cK3XEivK7VK/3AYvYwgF/rRoL+sn:DPCaJ/3AYvYwglFoL+sn
    MD5:87EDBEE38F56C20298F25D5D3D4D1B5C
    SHA1:7F904E9615AC3186A87472EF366DD8202855B0B7
    SHA-256:A46B56D3ABCC137D1872DDF20EED4BCD7D04518282282ADB32DDCCF70D7FFBA6
    SHA-512:BBEBC1FCD5BC9AE042DD5782425BA8C47BF3EAC283B2487FC4E3FF6BF8101306DAB081E5135594165D4DC1AC120FF125AADBC5B3FFE7C646183C04DF77865E0D
    Malicious:false
    Preview:Adobe Acrobat Reader (64-bit) 23.6.20320....?A12_AV2_Search_18px.............................................................................................................KKK KKK.KKK.KKK.KKK.KKK.KKK@........................................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.............................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.........................KKK.KKK.KKK.KKK0....................KKK.KKK.KKK.KKK`....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK.KKK.....................................KKK.KKK.....................KKK.KKK.KKK0................................KKK.KKK.....................KKK`KKK.KKK.............................KKK@KKK.KKK.....................KKK.KKK.KKK.KKK@....................KKK.KKK.KKK.KKK`........................KKKPKKK.KKK.KKK.KKK.........KKKPKKK.KKK.KKK.KKK.............................KKK`KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK.KKK

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):295
    Entropy (8bit):5.338104734356147
    Encrypted:false
    SSDEEP:6:YEQXJ2HXXaIEGhz7+FIbRI6XVW7+0YC7UoAvJM3g98kUwPeUkwRe9:YvXKXTvEYpW7ZnGMbLUkee9
    MD5:DB0158A8C5B08598260AA0A5E428CA48
    SHA1:3A87D65F00C875C8BC56619E2DE2DABC4F58AD4F
    SHA-256:4071485800116194C44982CA44FBAD3E95D50897001D6438512B001205BC7C14
    SHA-512:923C24F38314DDBCD561037BD57E749DDD61F6C099AC2BDA22DBA4F77E12ACB367B684AA19DA416E8B069BE9310A51AE877F91D3C73E784094B90E1B69095FEA
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"e333d9f2-cf83-4f9c-b110-9c7d200542f3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714137196459,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):294
    Entropy (8bit):5.275714683684541
    Encrypted:false
    SSDEEP:6:YEQXJ2HXXaIEGhz7+FIbRI6XVW7+0YC7UoAvJfBoTfXpnrPeUkwRe9:YvXKXTvEYpW7ZnGWTfXcUkee9
    MD5:DF0AFEBB848665D1F96B39C5FEDAC680
    SHA1:24023A0AF4AF8A308FA759B5C55DAB3152A1F43E
    SHA-256:B05B850551A159F5E915AD45AEEBCFAA0B6A78911F12C1EECA2F8AA5C1CFF871
    SHA-512:464DF25C0F3C5EBAF629F22F780585F9B448613CF0FB3BBBF7FE727DC964BC4812B262033016DA426DEB16C2AF4FE743A7A82C4A95AFE2C4DDFFEB15DDB1C423
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"e333d9f2-cf83-4f9c-b110-9c7d200542f3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714137196459,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):294
    Entropy (8bit):5.2535647772616105
    Encrypted:false
    SSDEEP:6:YEQXJ2HXXaIEGhz7+FIbRI6XVW7+0YC7UoAvJfBD2G6UpnrPeUkwRe9:YvXKXTvEYpW7ZnGR22cUkee9
    MD5:C7AFE728D8B64BCA237CFC61043A3965
    SHA1:DC7AC199E95FCF28E786278D6147184830F28263
    SHA-256:323CBACC8BB7EC9309DD9E58FBB0A3628BA5D47221A4784B7A8836B6BEB6D26D
    SHA-512:0172085AAA192D660E6CEA6E57CE0AD58AA3C04DDB87DEEB86944B127BFC770ECAB374251C86A1FAA924B1C8BC816835260ED4954E3E52904A96E5A825CEC6F1
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"e333d9f2-cf83-4f9c-b110-9c7d200542f3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714137196459,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):285
    Entropy (8bit):5.316111343520221
    Encrypted:false
    SSDEEP:6:YEQXJ2HXXaIEGhz7+FIbRI6XVW7+0YC7UoAvJfPmwrPeUkwRe9:YvXKXTvEYpW7ZnGH56Ukee9
    MD5:C64D94DF473DFA062CA32542BFD27952
    SHA1:ED5F129679E5ADD5EE978A84F8D4AF0BBE9F3915
    SHA-256:58AA9B0519395DFA1162407272CBD3190E386B973D18B8D4D3A3308108202FBD
    SHA-512:7539F387CA57531728B70FBA483699FD75D378D3DA658C3F3D792B1F7477CD131CBE77F11FF9EFF217111425F29CCEE2AC4EFB7A07D5D375B4C7DA3C7923D8D0
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"e333d9f2-cf83-4f9c-b110-9c7d200542f3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714137196459,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):292
    Entropy (8bit):5.277221463188724
    Encrypted:false
    SSDEEP:6:YEQXJ2HXXaIEGhz7+FIbRI6XVW7+0YC7UoAvJfJWCtMdPeUkwRe9:YvXKXTvEYpW7ZnGBS8Ukee9
    MD5:4F504DF3CBF552B7516CBD9AC1144C5F
    SHA1:29091BFEAA47CFDA61640C5BC0344FE403C3C0B2
    SHA-256:F0A07EB2E22CBCDBB48602F9B83C60683290F5D3A470A5D250A341FEF92C8BCF
    SHA-512:C71F5FFD588A69F6550C24E4AFE742EA929A6AC6E2DB64B3092879FA4E3DF5ED4AEBCC515F0DBFFD25CD0AB2C704447C04EFC5C04C2DBA37F096F71A51556AD0
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"e333d9f2-cf83-4f9c-b110-9c7d200542f3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714137196459,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):289
    Entropy (8bit):5.262343037528722
    Encrypted:false
    SSDEEP:6:YEQXJ2HXXaIEGhz7+FIbRI6XVW7+0YC7UoAvJf8dPeUkwRe9:YvXKXTvEYpW7ZnGU8Ukee9
    MD5:D0DFBA76318B48A908A3D4D738262BA6
    SHA1:2A237708E86DDFD8EB2ED4ED8DECCBBB66CBB966
    SHA-256:7CC11D4720C461C6E9F8649E69CE32B1BD3365C276744589E337CE889C7387E2
    SHA-512:7BD7643D76F9257BD361E43AD58EFA15E50322C05770831674DD157FFA262C33A3CE4EA8F01A599C11C7C28AB56A654653FF8FA3C53CE9FB7617732451254A52
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"e333d9f2-cf83-4f9c-b110-9c7d200542f3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714137196459,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):292
    Entropy (8bit):5.2633554987101
    Encrypted:false
    SSDEEP:6:YEQXJ2HXXaIEGhz7+FIbRI6XVW7+0YC7UoAvJfQ1rPeUkwRe9:YvXKXTvEYpW7ZnGY16Ukee9
    MD5:8F18B623C6ADF2F01631BAE2DD1BAB8E
    SHA1:2ACA4F0646D52814851326DD80F3346C0B53BA65
    SHA-256:E1D8F9A5275720B8C6D0093D7CE59763DDA72A351D8059EBC322CDD2BE2BBB90
    SHA-512:E5497C5233A042A414E4E60B031ABFFDC54FA5F2C8DA9A2D6EA96C71375CFCD4A73E2B264D1954AE7F2C3E0C5F5FF243382AB4A552F5632914670D46AEAD64F0
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"e333d9f2-cf83-4f9c-b110-9c7d200542f3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714137196459,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):289
    Entropy (8bit):5.2833145442858225
    Encrypted:false
    SSDEEP:6:YEQXJ2HXXaIEGhz7+FIbRI6XVW7+0YC7UoAvJfFldPeUkwRe9:YvXKXTvEYpW7ZnGz8Ukee9
    MD5:2D1016B7B454BBA2D705DB3D84CE5B5B
    SHA1:29AF71869B4112800E118593DC35DCC430456870
    SHA-256:47680C72E9AEA5ECE20359918D45DEB3279B927DA6D8FAB4B30C93703D03B699
    SHA-512:BB2F2D55658A816D4C0EAA832BD563D58B937D56AB353BB85B60F0614F0D542BB6F3313C13CDC21CBE4DE0C30C1B2B8E54A0A993F954CF19475602B815BDAA20
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"e333d9f2-cf83-4f9c-b110-9c7d200542f3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714137196459,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):1372
    Entropy (8bit):5.739070908085887
    Encrypted:false
    SSDEEP:24:Yv6XhiZ/KLgENRcbrZbq00iCCBrwJo++ns8ct4mFJNel:Yv3Z/EgigrNt0wSJn+ns8cvFJYl
    MD5:5A0E7530F0F72510F31EFEFF34C3F89F
    SHA1:2B07D086DAAF2132D7B350D5968A28F8D3029811
    SHA-256:93005E94F8FC94AB5790977375C3F98BD48C23537BE7281F6801B00F100CB90C
    SHA-512:7EEEA73D0F35159DBEE2BF02840D941F235D08E0B3735E0080B6B4C920515D731E35BEACB43ECDD72E09D1EC748E36D9AE29AEE5046729B06904479B57B816ED
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"e333d9f2-cf83-4f9c-b110-9c7d200542f3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714137196459,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Home_LHP_Trial_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"79887_247329ActionBlock_0","campaignId":79887,"containerId":"1","controlGroupId":"","treatmentId":"acc56846-d570-4500-a26e-7f8cf2b4acad","variationId":"247329"},"containerId":1,"containerLabel":"JSON for DC_Reader_Home_LHP_Trial_Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJUcnkgQWNyb2JhdCBQcm8ifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNSIsImZvbnRfc3R5bGUiOiIwIn0sImRlc2NyaXB0aW9uX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTMiLCJmb250X3N0eWxlIjoiLTEifSwidGl0bGUiOiJGcmVlIDctZGF5IHRyaWFsIiwiZGVzY3JpcHRpb24iOiJHZXQgdW5saW1pdGVkIGFjY2VzcyB0byBwcmVtaXVtIFBERiBhbmQgZS1zaWduaW5nIHRvb2xzLiIsImJ

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):289
    Entropy (8bit):5.271063476470055
    Encrypted:false
    SSDEEP:6:YEQXJ2HXXaIEGhz7+FIbRI6XVW7+0YC7UoAvJfYdPeUkwRe9:YvXKXTvEYpW7ZnGg8Ukee9
    MD5:EFD15453E5A15CD45DCF8E5BB45E280D
    SHA1:18FD9D1C7C046263B822EBE512E46AB56DE87970
    SHA-256:5E643D8BC42BEC78B9C59A734F836F60E5D9AFF123AD93C62380191655D8FE76
    SHA-512:86C8303A0377946B1D4B0897F1554F5615EF1C0E4724A9E8BA66002B4E19B8C196B82EF8ACC9959E748FA219E4B386FD77BC8B19158B8F47B33B4826FB2B2585
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"e333d9f2-cf83-4f9c-b110-9c7d200542f3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714137196459,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):1395
    Entropy (8bit):5.773391328190729
    Encrypted:false
    SSDEEP:24:Yv6XhiZCrLgEGOc93W2JeFmaR7CQzttgBcu141CjrWpHfRzVCV9FJNGl:Yv3ZCHgDv3W2aYQfgB5OUupHrQ9FJUl
    MD5:030DF69699722E1AE76F4C7E3BD302F5
    SHA1:4EFE0BBABCE33DA2F484E3975E6FAC9AD385D6A5
    SHA-256:CB605EB06B0D27AC1036A8DD7A247DD3C3AF464E3E4ADBA4229164516B520A0A
    SHA-512:EBB2C76AC1DB2EC4FC7289F320B298C1B4AC73AAE7FB1DC416CA10CA48B0CC30EE9F654A815E113A70E45CA156770F38BE04531B77CFA27C5C0DF491D760BDD3
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"e333d9f2-cf83-4f9c-b110-9c7d200542f3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714137196459,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_RHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"57802_176003ActionBlock_0","campaignId":57802,"containerId":"1","controlGroupId":"","treatmentId":"d0374f2d-08b2-49b9-9500-3392758c9e2e","variationId":"176003"},"containerId":1,"containerLabel":"JSON for Reader DC RHP Banner","content":{"data":"eyJjdGEiOnsidHlwZSI6ImJ1dHRvbiIsInRleHQiOiJGcmVlIDctRGF5IFRyaWFsIiwiZ29fdXJsIjoiaHR0cHM6Ly9hY3JvYmF0LmFkb2JlLmNvbS9wcm94eS9wcmljaW5nL3VzL2VuL3NpZ24tZnJlZS10cmlhbC5odG1sP3RyYWNraW5naWQ9UEMxUFFMUVQmbXY9aW4tcHJvZHVjdCZtdjI9cmVhZGVyIn0sInVpIjp7InRpdGxlX3N0eWxpbmciOnsiZm9udF9zaXplIjoiMTQiLCJmb250X3N0eWxlIjoiMyJ9LCJkZXNjcmlwdGlvbl9zdHlsaW5nIjp7ImZvbnRfc2l6ZSI6IjEyIiwiZm9udF9zdHlsZSI6IjMifSwidGl0

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):291
    Entropy (8bit):5.254809450594297
    Encrypted:false
    SSDEEP:6:YEQXJ2HXXaIEGhz7+FIbRI6XVW7+0YC7UoAvJfbPtdPeUkwRe9:YvXKXTvEYpW7ZnGDV8Ukee9
    MD5:62D6799CC10BB1356B3DA7E5767C4C64
    SHA1:A32709A5100BFFBEBD4E9DA8249B7C88B56B56B9
    SHA-256:564027F76A6CD8210A63FFB2F2B7AE615542BF2D5C67D001071DCDB8371D907B
    SHA-512:93D67A06D0EEF946CA150709E45B75EA8BC9E24AF0D11E8CF0519FCC1332005A6EDBF4A20D7C73F4C4D081A3A9F207ADC93B44D7A3A1D0379ABF1B0B19EE5B17
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"e333d9f2-cf83-4f9c-b110-9c7d200542f3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714137196459,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):287
    Entropy (8bit):5.255432395089316
    Encrypted:false
    SSDEEP:6:YEQXJ2HXXaIEGhz7+FIbRI6XVW7+0YC7UoAvJf21rPeUkwRe9:YvXKXTvEYpW7ZnG+16Ukee9
    MD5:9A5B04D42EB1D9757788279F6CA06B0B
    SHA1:4AB1F855080AF1E083C3661CB2FBFE2CC3C2A4CB
    SHA-256:91FEB2875974CD0B0A5A5E0F7BB7CE39B0991FB4F3BD0DD1079A60F53D3C5FE2
    SHA-512:14ACC1AE345728C95D7DF9C4AFC821B2DF59A506F3EE3B9C5D1356F5084DB1CDB1880BB25703BEC4C2B751052401A2A90423776000952A138637B075463A987F
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"e333d9f2-cf83-4f9c-b110-9c7d200542f3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714137196459,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):289
    Entropy (8bit):5.277604787153981
    Encrypted:false
    SSDEEP:6:YEQXJ2HXXaIEGhz7+FIbRI6XVW7+0YC7UoAvJfbpatdPeUkwRe9:YvXKXTvEYpW7ZnGVat8Ukee9
    MD5:A8AA4146C415316EF715D66ACC2752E6
    SHA1:9BF677B5E37D6F9DEE688229245D12943E2E497B
    SHA-256:5DFCD05B5C2E826DAF4CB7AEB1FC3AD606EF01F5D3253B8037EAC8F8BB31C620
    SHA-512:7C3D90F92F379073BA4EAD3CE1FBF0C5A43F59FD04B3E57D2766937C4646BFE7BFA26B8C6DD0C97E41A0427F89F6FB9095F2D78FD1167AAECCFB877C940F01D9
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"e333d9f2-cf83-4f9c-b110-9c7d200542f3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714137196459,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):286
    Entropy (8bit):5.230298582474772
    Encrypted:false
    SSDEEP:6:YEQXJ2HXXaIEGhz7+FIbRI6XVW7+0YC7UoAvJfshHHrPeUkwRe9:YvXKXTvEYpW7ZnGUUUkee9
    MD5:EBC396E1BF3C640127E5F8F47860EDBB
    SHA1:A98B3B2CCDF597ADAD7A697BD826AF8C30E39943
    SHA-256:B134C9ADC65FE73C977AF3A8095B760B99932025EF5C90815BEC71F97F942205
    SHA-512:25C049510261B8F743FEF5E47C9659D62507C4DA8C97F1F7D2F88AA8579209055799070D29405B246E5DBC957BB171E3457032740C2147DE72723FE1AFD00DEC
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"e333d9f2-cf83-4f9c-b110-9c7d200542f3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714137196459,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):782
    Entropy (8bit):5.363864917820942
    Encrypted:false
    SSDEEP:12:YvXKXTvEYpW7ZnGTq16Ukee1+3CEJ1KXd15kcyKMQo7P70c0WM6ZB/uhWKln:Yv6XhiZn168CgEXX5kcIfANhBl
    MD5:EA71325D145F7144A90C7CDD40C968C3
    SHA1:D5B4B9B74749CC9C8057FF43E3D8A5D4DF2840BA
    SHA-256:C4BD12C6C93A41EF894FD1A21C2E45C8F51C2F61EB9EF2F3B8282078835C6F8F
    SHA-512:1E87D037373319B965D7E568E7B0EB82721F99E058F68265185D9F60E2B7DD6318AA9531D48DE21C831672E015B6DE345130EE9F66DECAB031B80D9C530163A9
    Malicious:false
    Preview:{"analyticsData":{"responseGUID":"e333d9f2-cf83-4f9c-b110-9c7d200542f3","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1714137196459,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"Edit_InApp_Aug2020"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"20360_57769ActionBlock_0","campaignId":20360,"containerId":"1","controlGroupId":"","treatmentId":"3c07988a-9c54-409d-9d06-53885c9f21ec","variationId":"57769"},"containerId":1,"containerLabel":"JSON for switching in-app test","content":{"data":"eyJ1cHNlbGxleHBlcmltZW50Ijp7InRlc3RpZCI6IjEiLCJjb2hvcnQiOiJicm93c2VyIn19","dataType":"application\/json","encodingScheme":true},"endDTS":1735804679000,"startDTS":1713962146487}}}}

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:data
    Category:dropped
    Size (bytes):4
    Entropy (8bit):0.8112781244591328
    Encrypted:false
    SSDEEP:3:e:e
    MD5:DC84B0D741E5BEAE8070013ADDCC8C28
    SHA1:802F4A6A20CBF157AAF6C4E07E4301578D5936A2
    SHA-256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
    SHA-512:65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
    Malicious:false
    Preview:....

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:JSON data
    Category:dropped
    Size (bytes):2814
    Entropy (8bit):5.140171209182384
    Encrypted:false
    SSDEEP:48:YFAV4ckJlcObhAgThoSNH0FRz66FKKscxf5W8w9t9OP9h:qAVSHvbhAgThoSJ0Dz66Fd5xRWT9TOPf
    MD5:7C4CFF60EC1E1EEFF9788C53667BA475
    SHA1:E4C2ED53EAA98DF80D48BEC3C71595FE1D493045
    SHA-256:E04740789AFD2D3361D3D30793A0561097660A9E6FB285726850BD8422011BA7
    SHA-512:6202E0421DA4706E16DCF2F00F4A9E18E8A328754B204326429394BF14E48732294526939EEC7EBD9AE298943B6EF143BFCE6AAB9386A120C469E213657F33E0
    Malicious:false
    Preview:{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"e91f94fc17416b20c156ed09cd6c5981","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1713962145000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"87fc51294c6ab2f3258e536b7d12a114","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":1372,"ts":1713962145000},{"id":"Edit_InApp_Aug2020","info":{"dg":"2aea8d217c71e7593af1c3c26908789e","sid":"Edit_InApp_Aug2020"},"mimeType":"file","size":782,"ts":1713962145000},{"id":"DC_Reader_RHP_Banner","info":{"dg":"d5961036cd45692adc14c4a19d2df4a6","sid":"DC_Reader_RHP_Banner"},"mimeType":"file","size":1395,"ts":1713962145000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"cd1ec42f7f45563d7d290a482c669b5d","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1713962145000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"cba2b6ff28480e0dbc4e82b387d14ef5","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","size":289,"ts":1713962145000},

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
    Category:dropped
    Size (bytes):12288
    Entropy (8bit):0.9840390128136142
    Encrypted:false
    SSDEEP:24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/Spkex4zJwtNBwtNbRZ6bRZ4LexF:TVl2GL7ms6ggOVpmzutYtp6P1
    MD5:8C02EBFD0DE3CA829B718C290EDE7320
    SHA1:22E875FBB34272C074FFA62633FA836467F522F8
    SHA-256:88E07EB3BD4D9DB0BCDD5C88009B5DC9CE7A4EDE08482C05752E5898652D19E0
    SHA-512:1AF7A6B3ACD181A7E2A8CCB38EC98201B65B235766A059E21B8CEA08692FE6F7CC5C15F221346B6EC20DC92A4716C8A61BD8F8375F9B2E24B3E8F14072829A29
    Malicious:false
    Preview:SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

    C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:SQLite Rollback Journal
    Category:dropped
    Size (bytes):8720
    Entropy (8bit):1.3384196341266148
    Encrypted:false
    SSDEEP:24:7+tmAD1RZKHs/Ds/SpkexPzJwtNBwtNbRZ6bRZWf1RZKwpqLBx/XYKQvGJF7ursp:7MmGgOVp9zutYtp6PMzpqll2GL7msp
    MD5:AC44BACA2B2EE40526A8D45FDC59B990
    SHA1:54F0E119CB50BE29680B382130E7256B57CC5468
    SHA-256:D14EE58D3C17DC8149E0B748582E6B0F84A170B74A3287CA3B1D2046410A1488
    SHA-512:E716126069989583B3B612D0635788D0CAF80D3A3E8FA2D769E07E8A3E0A081C84D9E3141DE4742B5ED8D288C601C7370D25237B137AC5E81862D9FF5B76CE9E
    Malicious:false
    Preview:.... .c......B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

    C:\Users\user\AppData\Local\Temp\MSI246c0.LOG

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
    Category:dropped
    Size (bytes):246
    Entropy (8bit):3.5162684137903053
    Encrypted:false
    SSDEEP:6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8c+aRdQKw:Qw946cPbiOxDlbYnuRKHYH
    MD5:EAE751F34A20385C146099F7D5FA39BD
    SHA1:DA7CB6AB0F1803D9511F7A485807B4803E8428EF
    SHA-256:30A17E3C08EE38806351C158B56601980B518E5E868A8270BF349D41AF6760A9
    SHA-512:147C9BCF5AF3A0723EF10868535DE5675D120A6A9F5C6FA1363C98B0E0AFD5B36C01E897C8D9411C9509AB3A137E7DE53E04D9454FBB880A72CF89342AF97998
    Malicious:false
    Preview:..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .2.4./.0.4./.2.0.2.4. . .1.4.:.3.5.:.4.5. .=.=.=.....

    C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-24 14-35-40-395.log

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:ASCII text, with very long lines (393)
    Category:dropped
    Size (bytes):16525
    Entropy (8bit):5.376360055978702
    Encrypted:false
    SSDEEP:384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
    MD5:1336667A75083BF81E2632FABAA88B67
    SHA1:46E40800B27D95DAED0DBB830E0D0BA85C031D40
    SHA-256:F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
    SHA-512:D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
    Malicious:false
    Preview:SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

    C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:ASCII text, with very long lines (393), with CRLF line terminators
    Category:dropped
    Size (bytes):16603
    Entropy (8bit):5.383400639423554
    Encrypted:false
    SSDEEP:384:eNJpUQlE5iCRvRy+F+B5zExBGl+hxlOGVCUGykoFuYRPO0nVkQvV4VkR+kY3oEIQ:IlL
    MD5:4DB512BFB4182D2734CDDDE307D20834
    SHA1:21D10AEE34E4B22FA9AD8DB72DDFB0C7CD201C7F
    SHA-256:8E1DE19E229BEFA8ADD833BB5CE922712293ECA7930D8D2D89D967A79D61D2BA
    SHA-512:76ABB33862DCE7E48D8236A1133DA9784C851943F112AE6F45F602989881AEC3607686104D37E93E24683C1C18DACCEB52FCDF7D3BA6028E5D5E79AD8F3853DD
    Malicious:false
    Preview:SessionID=a81946a5-8488-4b91-bdfc-879e66798dfc.1713962140405 Timestamp=2024-04-24T14:35:40:405+0200 ThreadID=4852 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=a81946a5-8488-4b91-bdfc-879e66798dfc.1713962140405 Timestamp=2024-04-24T14:35:40:406+0200 ThreadID=4852 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=a81946a5-8488-4b91-bdfc-879e66798dfc.1713962140405 Timestamp=2024-04-24T14:35:40:406+0200 ThreadID=4852 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=a81946a5-8488-4b91-bdfc-879e66798dfc.1713962140405 Timestamp=2024-04-24T14:35:40:407+0200 ThreadID=4852 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=a81946a5-8488-4b91-bdfc-879e66798dfc.1713962140405 Timestamp=2024-04-24T14:35:40:407+0200 ThreadID=4852 Component=ngl-lib_NglAppLib Description="SetConf

    C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    File Type:ASCII text, with CRLF line terminators
    Category:dropped
    Size (bytes):29845
    Entropy (8bit):5.385159859872756
    Encrypted:false
    SSDEEP:768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGbM:I
    MD5:43F7C0AD6BB8F00306F7770DBEC372DE
    SHA1:5E16C5916A565291AE173E689B6851066D328C7B
    SHA-256:0C2D27D7136C9DA3F2538FB9BB7206F5D51437751B696C47837400E15A396E42
    SHA-512:23B60CE875FB4F1150C85261A087AF0A7C9D3FC8D669620BB7693497D419CF7F18AF360C7181C4933A7F107B2988256C5508D1C9084A7B3228ECCAFEA2A1B059
    Malicious:false
    Preview:04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ******** Starting new session ********..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

    C:\Users\user\AppData\Local\Temp\acrocef_low\99fddabb-77b1-43cb-95ff-198b9a550b67.tmp

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
    Category:dropped
    Size (bytes):1419751
    Entropy (8bit):7.976496077007677
    Encrypted:false
    SSDEEP:24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
    MD5:18E3D04537AF72FDBEB3760B2D10C80E
    SHA1:B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
    SHA-256:BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
    SHA-512:2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
    Malicious:false
    Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

    C:\Users\user\AppData\Local\Temp\acrocef_low\adff171b-add1-42c9-9de1-3885190b8d65.tmp

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
    Category:dropped
    Size (bytes):386528
    Entropy (8bit):7.9736851559892425
    Encrypted:false
    SSDEEP:6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
    MD5:5C48B0AD2FEF800949466AE872E1F1E2
    SHA1:337D617AE142815EDDACB48484628C1F16692A2F
    SHA-256:F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
    SHA-512:44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
    Malicious:false
    Preview:...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-|..h#.g.\.PO.|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..|m.WC.....|.....e.[W.p.8...rm....^..x'......5!...|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

    C:\Users\user\AppData\Local\Temp\acrocef_low\bd6520e6-82d4-4fdd-9dc8-b43f6bd002a6.tmp

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
    Category:dropped
    Size (bytes):758601
    Entropy (8bit):7.98639316555857
    Encrypted:false
    SSDEEP:12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
    MD5:3A49135134665364308390AC398006F1
    SHA1:28EF4CE5690BF8A9E048AF7D30688120DAC6F126
    SHA-256:D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
    SHA-512:BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
    Malicious:false
    Preview:...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!|G.1...... .3.`./....`~......G.............|..pS.e.C....:o.u_..oi.:..|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

    C:\Users\user\AppData\Local\Temp\acrocef_low\eb079c42-d52a-43f1-9114-c910b24f90f5.tmp

    Download File
    Process:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    File Type:gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
    Category:dropped
    Size (bytes):1407294
    Entropy (8bit):7.97605879016224
    Encrypted:false
    SSDEEP:24576:/xA7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R07/WLaGZDwYIGNPJe:JVB3mlind9i4ufFXpAXkrfUs0jWLaGZo
    MD5:A0CFC77914D9BFBDD8BC1B1154A7B364
    SHA1:54962BFDF3797C95DC2A4C8B29E873743811AD30
    SHA-256:81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
    SHA-512:74A8F6D96E004B8AFB4B635C0150355CEF5D7127972EA90683900B60560AA9C7F8DE780D1D5A4A944AF92B63C69F80DCDE09249AB99696932F1955F9EED443BE
    Malicious:false
    Preview:...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E|.P..$ni.{.....T.^~<m-..J....RQk..*..f.....q.......V.rC.M.b.DiL\.....wq.*...$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..D*T...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W*..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.......*..R.....j.WD).M..9.Fw...W.-a..z.l\..u*.^....*L..^.`.T...l.^.B.DMc.d....i...o.|M.uF|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,*.e....5...X.}6.P....y\.s|..Si..BB..y...~.....D^g...*7'T-.5*.!K.$\...2.

    Static File Info

    General

    File type:PDF document, version 1.7
    Entropy (8bit):7.9911498289339615
    TrID:
    • Adobe Portable Document Format (5005/1) 100.00%
    File name:0060599005-A05-049-4.pdf
    File size:378'868 bytes
    MD5:398a2ac72d023fee742020f4c5bd9afc
    SHA1:65e4dfd26cc6bd07967558ee01691661faaad4c3
    SHA256:e73b7f86bf046705c827bfb3e87f7787245aa04a365d08c51a2f8ae185918068
    SHA512:328884f7d431a0019d6b24e7ed3138e8fe64f1de9c97e801d493676aab64515dfc465b1ebf6db0629f9cc4dde76611b425d3e72cbb8703a10390b58b0114808e
    SSDEEP:6144:DMFaDmw7wBrtnmR/3RRRRRRhxsvR27BR7z1cOq0+yVzQowjCbrgzDX/wl88P3pmZ:DMFaaYs5n0pxsvREDhcv0+ytQo5rQnKc
    TLSH:478423159A3EC0EEB616D726A8782E71B1C391813C4136BF356C8C4D1711DA8ED8DFEA
    File Content Preview:%PDF-1.7.%.....2 0 obj<</AcroForm 4 0 R/Metadata 5 0 R/PageLabels 6 0 R/Pages 7 0 R/StructTreeRoot 8 0 R/Type/Catalog>>.endobj.5 0 obj<</Length 3254/Subtype/XML/Type/Metadata>>.stream.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:

    File Icon

    Icon Hash:62cc8caeb29e8ae0

    Static PDF Info

    General

    Header:%PDF-1.7
    Total Entropy:7.991150
    Total Bytes:378868
    Stream Entropy:7.993229
    Stream Bytes:373509
    Entropy outside Streams:5.151837
    Bytes outside Streams:5359
    Number of EOF found:1
    Bytes after EOF:

    Keywords Statistics

    NameCount
    obj54
    endobj54
    stream53
    endstream53
    xref0
    trailer0
    startxref1
    /Page0
    /Encrypt0
    /ObjStm2
    /URI0
    /JS0
    /JavaScript0
    /AA0
    /OpenAction0
    /AcroForm1
    /JBIG2Decode0
    /RichMedia0
    /Launch0
    /EmbeddedFile0

    Image Streams

    IDDHASHMD5Preview
    44080800002103462905d51d1d4b577ca1876d5133956e8427
    4575b7979d8c6363d90900e8c0280307fe47e5dad1f335f493
    1523613934133170b37e69cdd54c9d045c69ec6ecd0f0c866a2
    1858c8db4cbf23f473dddeeeff2e427b89fd02b60635ae7f86d

    Network Behavior

    Network Port Distribution

    TCP Packets

    TimestampSource PortDest PortSource IPDest IP
    Apr 24, 2024 14:35:51.557400942 CEST49737443192.168.2.523.61.208.184
    Apr 24, 2024 14:35:51.557441950 CEST4434973723.61.208.184192.168.2.5
    Apr 24, 2024 14:35:51.557544947 CEST49737443192.168.2.523.61.208.184
    Apr 24, 2024 14:35:51.557910919 CEST49737443192.168.2.523.61.208.184
    Apr 24, 2024 14:35:51.557924032 CEST4434973723.61.208.184192.168.2.5
    Apr 24, 2024 14:35:52.042715073 CEST4434973723.61.208.184192.168.2.5
    Apr 24, 2024 14:35:52.043045998 CEST49737443192.168.2.523.61.208.184
    Apr 24, 2024 14:35:52.043064117 CEST4434973723.61.208.184192.168.2.5
    Apr 24, 2024 14:35:52.047385931 CEST4434973723.61.208.184192.168.2.5
    Apr 24, 2024 14:35:52.047456980 CEST49737443192.168.2.523.61.208.184
    Apr 24, 2024 14:35:52.049534082 CEST49737443192.168.2.523.61.208.184
    Apr 24, 2024 14:35:52.049781084 CEST49737443192.168.2.523.61.208.184
    Apr 24, 2024 14:35:52.049788952 CEST4434973723.61.208.184192.168.2.5
    Apr 24, 2024 14:35:52.049963951 CEST4434973723.61.208.184192.168.2.5
    Apr 24, 2024 14:35:52.094153881 CEST49737443192.168.2.523.61.208.184
    Apr 24, 2024 14:35:52.094167948 CEST4434973723.61.208.184192.168.2.5
    Apr 24, 2024 14:35:52.141000986 CEST49737443192.168.2.523.61.208.184
    Apr 24, 2024 14:35:52.210901976 CEST4434973723.61.208.184192.168.2.5
    Apr 24, 2024 14:35:52.210966110 CEST4434973723.61.208.184192.168.2.5
    Apr 24, 2024 14:35:52.211081028 CEST49737443192.168.2.523.61.208.184
    Apr 24, 2024 14:35:52.211639881 CEST49737443192.168.2.523.61.208.184
    Apr 24, 2024 14:35:52.211657047 CEST4434973723.61.208.184192.168.2.5

    DNS Answers

    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
    Apr 24, 2024 14:35:32.696691990 CEST1.1.1.1192.168.2.50x6f1dNo error (0)fp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.phicdn.netCNAME (Canonical name)IN (0x0001)false
    Apr 24, 2024 14:35:32.696691990 CEST1.1.1.1192.168.2.50x6f1dNo error (0)fp2e7a.wpc.phicdn.net192.229.211.108A (IP address)IN (0x0001)false

    HTTP Request Dependency Graph

    • armmf.adobe.com

    HTTPS Proxied Packets

    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
    0192.168.2.54973723.61.208.1844437360C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    TimestampBytes transferredDirectionData
    2024-04-24 12:35:52 UTC475OUTGET /onboarding/smskillreader.txt HTTP/1.1
    Host: armmf.adobe.com
    Connection: keep-alive
    Accept-Language: en-US,en;q=0.9
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) ReaderServices/23.6.20320 Chrome/105.0.0.0 Safari/537.36
    Sec-Fetch-Site: same-origin
    Sec-Fetch-Mode: no-cors
    Sec-Fetch-Dest: empty
    Accept-Encoding: gzip, deflate, br
    If-None-Match: "78-5faa31cce96da"
    If-Modified-Since: Mon, 01 May 2023 15:02:33 GMT
    2024-04-24 12:35:52 UTC198INHTTP/1.1 304 Not Modified
    Content-Type: text/plain; charset=UTF-8
    Last-Modified: Mon, 01 May 2023 15:02:33 GMT
    ETag: "78-5faa31cce96da"
    Date: Wed, 24 Apr 2024 12:35:52 GMT
    Connection: close


    Statistics

    CPU Usage

    Click to jump to process

    Memory Usage

    Click to jump to process

    High Level Behavior Distribution

    Click to dive into process behavior distribution

    Behavior

    Click to jump to process

    System Behavior

    General

    Target ID:0
    Start time:14:35:36
    Start date:24/04/2024
    Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
    Wow64 process (32bit):false
    Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\0060599005-A05-049-4.pdf"
    Imagebase:0x7ff686a00000
    File size:5'641'176 bytes
    MD5 hash:24EAD1C46A47022347DC0F05F6EFBB8C
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:moderate
    Has exited:true

    General

    Target ID:2
    Start time:14:35:37
    Start date:24/04/2024
    Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    Wow64 process (32bit):false
    Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
    Imagebase:0x7ff6413e0000
    File size:3'581'912 bytes
    MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:moderate
    Has exited:true

    General

    Target ID:4
    Start time:14:35:38
    Start date:24/04/2024
    Path:C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
    Wow64 process (32bit):false
    Commandline:"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1648,i,11272463363651122756,7076105234141228624,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
    Imagebase:0x7ff6413e0000
    File size:3'581'912 bytes
    MD5 hash:9B38E8E8B6DD9622D24B53E095C5D9BE
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:C, C++ or other language
    Reputation:moderate
    Has exited:true

    Disassembly

    ⊘No disassembly